GET /api/v1/models requires an API key. The key is read from two possible headers — pick one.
Key format
- Always starts with
vg_, followed by 32 hexadecimal characters. Beareris case-insensitive (bearer vg_...is accepted too).- The
vg_prefix is mandatory. A key without the prefix is rejected even if the rest is correct. - Keys are created on the dashboard API key page; the raw key is shown only once.
Authentication failures
Every authentication failure uses the same body shape:
{ "error": "..." }. There is no numeric code — use the HTTP status to tell them apart.Security
Send it over HTTPS only. A key must never travel through an
http:// URL or be pasted into a query string.Name each key after its environment.
staging, prod-cron, lokal-andi — so that revoking one key does not take another system down.Do not store keys in mobile apps or frontend bundles that can be unpacked. If a key leaked, revoke it and create a new one — rotation is the only way to revoke.
Endpoints that do not need a key
GET /api/v1/models may be called without authentication because it only contains the public catalog. If your application shows prices or balances, still send a key.
Continue to Base URL.